December 2016 Summaries

This vulnerability analysis reveals three critical security issues in the open-source marketplace software osClass 3.6.1: Cross-Site Scripting, File Write, and File Inclusion vulnerabilities. The exploitation of these vulnerabilities can lead to remote code execution on a targeted web server when chained together. The Cross-Site Scripting vulnerability allows an authenticated administrator to execute arbitrary PHP code by visiting a malicious link, while the File Write vulnerability enables an attacker to upload images with malicious EXIF data that contain PHP code. The File Inclusion vulnerability allows an attacker to include arbitrary files via the GET parameter plugin, which can be installed persistently in the database. The analysis highlights the importance of input sanitization and validation to prevent such vulnerabilities, as well as the need for automated security testing tools to quickly detect and chain these issues together.

SonarSource is introducing `Cognitive Complexity` as an alternative to `Cyclomatic Complexity`, which measures testability, but not maintainability. Cognitive Complexity aims to provide a fair representation of how difficult control flow in a method is to understand and maintain. It increments for structures that break the linear flow of code, nesting, and ignores "shorthand" structures. The new metric is designed to incent good coding practices by penalizing complex constructs and ignoring readable ones. Cognitive Complexity will be added as a method-level rule in mainline languages, initially starting with Java, JavaScript, C#, and C/C++/Objective-C, with the goal of eventually adding class/file-level rules.

The widely distributed open-source webmail software Roundcube has a highly critical vulnerability in version 1.2.2 that allows a malicious user to remotely execute arbitrary commands on the underlying operating system by writing an email with a specific payload, which can be triggered by exploiting insufficient sanitization of user-controlled input in PHP's mail() function and configuration requirements such as safe_mode being turned off. The vulnerability is exploited when an attacker modifies the _from parameter in an HTTP request to place a malicious PHP file on the file system, allowing for arbitrary code execution. A proof-of-concept demonstrates the attack scenario, and the Roundcube team has released an updated version 1.2.3 with a fix after only one week of coordination with the vendor, showcasing their professional response towards security issues.